← All seven stages

Stage 7 / 7 · Pursue the intended outcome

Actions on Objectives

Theft, espionage, disruption, destruction, encryption, fraud, and other mission outcomes.

64 readings · Guides can appear in more than one stage.

Understanding Actions on Objectives

Actions on Objectives are the activities through which the adversary pursues the intended outcome of the operation. That outcome may be intelligence collection, theft, financial gain, disruption, destruction, or manipulation. This stage explains why the intrusion matters to the affected organization.

Typical activities

Example: An account accesses an unusual volume of sensitive files and transfers data to an external destination. Access logs, transfer evidence, and the business role of those files help distinguish collection from demonstrated theft.

Objectives are not limited to exfiltration or ransomware. Internal discovery, credential access, and lateral movement may be enabling steps toward an objective rather than the final outcome themselves. A capability to destroy or steal data does not establish that destruction or theft occurred.

Defender’s question: What outcome was pursued, what was actually achieved, and which evidence supports the resulting business impact?

Guides and articles by Andrey 61

Practical exercises 1

Attributed TrainSec readings 2

Public technical readings by the credited TrainSec authors. These link to the original canonical publications and are separate from Andrey’s original companion guides. Private course lessons are not reproduced here.

Authoritative external resources

Read Lockheed Martin’s Cyber Kill Chain for the stage definition, then use these primary technical references:

Defensive focus: Relate collection, movement, and impact evidence to the objective; distinguish demonstrated harm from plausible capability.

Methods across stages

Use the CTI Analyst Field Manual for evidence and confidence, detection engineering guide for telemetry and validation, and practical learning paths for bounded exercises. These methods support several stages; they are not additional Kill Chain stages.

Source lifecycle, version boundaries, course access terms, and lab limitations still apply. Password recovery and lab exercises are learning analogues, not evidence of a real compromise.